"Sandboxing" can mean one of ten different things, and the ideal is completely dependent on the use case. I highly doubt the same solution would work for, say,

"Sandboxing" can mean one of ten different things, and the ideal is completely dependent on the use case. I highly doubt the same solution would work for, say, both system services and GUI apps. Right now, NixOS has declarative containers (based on systemd-nspawn) and FHS-compatible user environments based on bubblewrap (where you bring your own packages; see the pkgs.steam attrset for example). What do you want out of sandboxing in NixOS?